LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1239: TONESHELL

TONESHELL is a custom backdoor that has been used since at least Q1 2021.[1] TONESHELL malware has previously been leveraged by Chinese affiliated actors identified as Mustang Panda.[2][3]

EnterpriseS1239MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

TONESHELL is a Windows backdoor documented in ATT&CK as used since at least Q1 2021 and previously leveraged by Mustang Panda. Its mapped behaviors span command-and-control, discovery, execution, persistence, stealth, credential collection, and screen capture, making it relevant to leadership as a post-compromise capability rather than a single alert signature. The business question is whether Windows endpoint, network, and identity telemetry can reconstruct what a backdoor did after access was gained.

Executive priority

Prioritize TONESHELL as a resilience and response-readiness issue: if a custom backdoor reaches Windows systems, defenders need evidence for C2 traffic, host discovery, persistence through scheduled tasks or services, command execution, credential exposure through keylogging, and possible collection such as screen capture. Security leaders should ask whether SOC and IR teams can prove coverage for these behaviors, not just whether a known malware hash is blocked. This is especially important for organizations where espionage, sensitive document access, government or NGO exposure, or audit evidence around endpoint monitoring and incident containment are material concerns.

Technical view

ATT&CK does not provide a dedicated detection section for TONESHELL, so validation should be behavior-led using the mapped relationships. On Windows, review coverage for WMI execution, Windows command shell use, scheduled task creation or modification, suspicious service/task masquerading, DLL injection, dynamic API resolution indicators, file deletion, LNK shortcut abuse, discovery commands or API activity for users/processes/windows/system information/accounts, keylogging and screen capture indicators, ingress tool transfer, and C2 over web protocols, non-application-layer protocols, protocol/service impersonation, and non-standard encoding. Treat the Mustang Panda relationship as threat-intelligence context for prioritization, not as standalone proof of attribution in a local incident.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows scheduled task and service creation/modification logs
  • WMI activity and remote/local execution records
  • Endpoint file creation, deletion, rename, and shortcut/LNK metadata observations
  • EDR memory/process telemetry for DLL injection or suspicious native API use

Detection direction

  • Because no official TONESHELL detection text is supplied, build detections around the related ATT&CK techniques rather than relying on static indicators alone.
  • Tune for combinations: scheduled task or masqueraded service creation followed by command shell/WMI execution, discovery activity, file transfer, and unusual outbound communications is more meaningful than any one event by itself.
  • Validate network visibility for web-protocol C2, protocol impersonation, non-application-layer communications, and non-standard encoding; encrypted or protocol-like traffic may reduce content inspection value, so metadata and endpoint correlation matter.
  • Review false positives carefully for administration tools: WMI, scheduled tasks, cmd.exe, native APIs, and service changes are common in legitimate IT operations and need baselines, signer/path context, parent-child process context, and change-management correlation.
  • Check blind spots around oversized or padded binaries, dynamically resolved APIs, LNK metadata abuse, and process injection, as these behaviors can weaken hash-based, static, or superficial file inspection.

Mitigation priorities

  • Start with telemetry assurance: confirm Windows endpoints, network egress points, and identity-relevant logs are collected, retained, and searchable for the mapped behaviors.
  • Reduce execution and persistence opportunities by hardening scheduled task, service, WMI, command shell, and shortcut handling according to enterprise policy and least-privilege administration.
  • Strengthen endpoint prevention and monitoring for process injection, suspicious native API use, file deletion after execution, and masqueraded binaries or services.
  • Apply egress control and monitoring for unusual outbound web traffic, non-standard protocols, and protocol impersonation patterns; ensure exceptions are governed and reviewed.
  • Prepare IR playbooks for suspected backdoor activity that include host isolation, persistence review, credential exposure assessment, account discovery follow-up, and collection impact scoping.
Additional notes and limits

This take is based on ATT&CK S1239 TONESHELL, its official description, external references, and listed relationships. The object is a Windows malware entry with no ATT&CK tactics specified directly and no official detection guidance provided. The related techniques supply the practical defensive lens: C2, execution, persistence, stealth, discovery, credential collection, collection, and tool transfer behaviors.

Local exposure, active exploitation, specific indicators, affected business units, and detection coverage cannot be inferred from the supplied ATT&CK fields. Some related techniques list broader platforms, but the TONESHELL object itself is supplied as Windows. Any attribution to Mustang Panda in an investigation should be treated as contextual until supported by environment-specific evidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

TONESHELL

TONESHELL is a custom backdoor that has been used since at least Q1 2021.[1] TONESHELL malware has previously been leveraged by Chinese affiliated actors identified as Mustang Panda.[2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

43 rows
DomainIDNameRelationship / procedure
EnterpriseT1480.001Environmental KeyingSub-technique

TONESHELL has generated unique GUIDs to identify victim devices.[4][5][3] TONESHELL has leveraged environmental keying in payload delivery using the victim computer name and other configuration values.[6] TONESHELL has also tracked IDs associated with reverse shell subprocesses to manage interactions and terminations from C2.[4][3]

EnterpriseT1480Execution Guardrails

TONESHELL has an exception handler that executes when ESET antivirus applications `ekrn.exe` and `egui.exe` are not found and directly injects its code into waitfor.exe using Native Windows API including `WriteProcessMemory` and `CreateRemoteThreadEx`.[4]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

TONESHELL has renamed malicious files to mimic legitimate file names and file extensions.[5] TONESHELL has also masqueraded as legitimate file names to include LogMeIn.dll.[3]

EnterpriseT1518.001Security Software DiscoverySub-technique

TONESHELL has checked for the presence of ESET antivirus applications `ekrn.exe` and `egui.exe`.[4]

EnterpriseT1678Delay Execution

TONESHELL has the ability to pause operations for a specified duration prior to follow-on execution of activities.[3]

EnterpriseT1113Screen Capture

TONESHELL has conducted screen capturing.[1]

EnterpriseT1497.002User Activity Based ChecksSub-technique

TONESHELL has leveraged `GetForegroundWindow` to detect virtualization or sandboxes by calling the API twice and comparing each window handle.[5]

EnterpriseT1057Process Discovery

TONESHELL has checked the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.[5] TONESHELL has also searched for running antivirus processes to include ESET’s antivirus associated executables ekrn.exe and egui.exe.[4]

EnterpriseT1082System Information Discovery

TONESHELL has the ability to retrieve the name of the infected machine.[6][4][3]

EnterpriseT1027.007Dynamic API ResolutionSub-technique

TONESHELL has utilized a modified DJB2 algorithm to resolve APIs.[3]

EnterpriseT1574.001DLLSub-technique

TONESHELL has abused legitimate executables to side-load malicious DLLs.[7][2][1][4][5][8] TONESHELL has also been loaded via DLL side-loading, using legitimate, signed executables to include: FastVD.exe, Bandizip.exe and gpgconf.exe.[3]

EnterpriseT1053.005Scheduled TaskSub-technique

TONESHELL has created scheduled tasks to maintain persistence.[2][1]

EnterpriseT1047Windows Management Instrumentation

TONESHELL has used WMI queries to gather information from the system.[2]

EnterpriseT1132.002Non-Standard EncodingSub-technique

TONESHELL has encoded a payload with a random 32-byte key using XOR.[5] TONESHELL has also encoded payloads with a 256-byte key using XOR.[6]

EnterpriseT1680Local Storage Discovery

TONESHELL has retrieved the disk serial number of the device using WMI query `SELECT volumeserialnumber FROM win32_logicaldisk where Name =’C:` to identify the victim machine.[2]

EnterpriseT1070.004File DeletionSub-technique

TONESHELL has deleted payload files received from the C2 server.[3]

EnterpriseT1056.001KeyloggingSub-technique

TONESHELL has capabilities to conduct keylogging.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

TONESHELL has added Registry Run keys to achieve persistence.[1]

EnterpriseT1105Ingress Tool Transfer

TONESHELL has the ability to download additional files to the victim device.[1]

EnterpriseT1010Application Window Discovery

TONESHELL has used `GetForegroundWindow` to detect virtualization or sandboxes by calling the API twice and comparing each window handle.[5]

EnterpriseT1218.010Regsvr32Sub-technique

TONESHELL has used regsvr32.exe to execute the windows `DLLRegisterServer` function.[4]

EnterpriseT1553.002Code SigningSub-technique

TONESHELL has used valid legitimate digital signatures and certificates to evade detection.[7]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

TONESHELL has used DLL injection to execute payloads received from the C2 server.[3]

EnterpriseT1573.001Symmetric CryptographySub-technique

TONESHELL has used RC4 encryption in C2 communications.[5] TONESHELL variants used a randomly generated variable length (0x20 - 0x200 bytes) rolling XOR key to encrypt and decrypt network packets.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

TONESHELL has decoded its payload prior to execution.[6][4][5][3][9]

EnterpriseT1543.003Windows ServiceSub-technique

TONESHELL has created a malicious service DISMsrv to maintain persistence.[1]

EnterpriseT1095Non-Application Layer Protocol

TONESHELL has utilized TCP-based reverse shells.[5]

EnterpriseT1071.001Web ProtocolsSub-technique

TONESHELL has utilized HTTP for a C2 protocol through HTTP POST.[7][5] TONESHELL has also utilized HTTPS for C2.[6]

EnterpriseT1027.001Binary PaddingSub-technique

TONESHELL has used randomized padding to obfuscate payloads.[3][9]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

TONESHELL has masqueraded as the legitimate Windows utility service DISMsrv (Dism Images Servicing Utility Service).[1]

EnterpriseT1622Debugger Evasion

TONESHELL has leveraged custom exception handlers to hide code flow and stop execution of a debugger.[5]

EnterpriseT1218.013MavinjectSub-technique

TONESHELL has injected its malicious payload into a running process through Windows utility Microsoft Application Virtualization Injector `MAVInject.exe`.[4]

EnterpriseT1134.002Create Process with TokenSub-technique

TONESHELL included functionality to create sub-processes with a specific user’s token.[3]

EnterpriseT1087Account Discovery

TONESHELL included functionality to retrieve a list of user accounts.[3]

EnterpriseT1480.002Mutual ExclusionSub-technique

TONESHELL has created a mutex to avoid duplicate execution.[6]

EnterpriseT1033System Owner/User Discovery

TONESHELL has obtained the username from an infected host.[5]

EnterpriseT1106Native API

TONESHELL has utilized Native Windows API functions such as `WriteProcessMemory` and `CreateRemoteThreadEx`.[4] TONESHELL has also utilized Windows API functions for creating seed values including `CoCreateGuid` and `GetTickCount`.[6][3] TONESHELL has leveraged the legitimate API function `EnumSystemLocalesA` to run its shellcode through the callback function.[10]

EnterpriseT1205Traffic Signaling

TONESHELL has utilized a magic value in C2 communications and only executes in memory when response packets match specific values.[4][5][8]

EnterpriseT1059.003Windows Command ShellSub-technique

TONESHELL has created a reverse shell using `cmd.exe`.[6][3]

EnterpriseT1027.012LNK Icon SmugglingSub-technique

TONESHELL has been initiated using LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.[7]

EnterpriseT1559Inter-Process Communication

TONESHELL has facilitated inter-process communication between DLL components via the use of pipes.[1] TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.[6]

EnterpriseT1001.003Protocol or Service ImpersonationSub-technique

TONESHELL used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic.[6][3] TONESHELL variants have utilized FakeTLS headers with the bytes `0x17 0x03 0x03` to represent TLSv1.2 and `0x17 0x03 0x04` for TLSv1.3.[3]

EnterpriseT1560.001Archive via UtilitySub-technique

TONESHELL used WinRAR rar.exe to archive files for exfiltration.[1][9] TONESHELL has also utilized a unique 13-character password consisting of upper lower case and digits to protect RAR archives.[9]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1480.001: Environmental KeyingEnterpriseuses · TechniqueT1480: Execution GuardrailsEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1678: Delay ExecutionEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1497.002: User Activity Based ChecksEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1027.007: Dynamic API ResolutionEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · GroupG0129: Mustang PandaEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1132.002: Non-Standard EncodingEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1010: Application Window DiscoveryEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
6dac529afe0fb6f0...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle6dac529afe0f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  2. [2]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  3. [3]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  4. [4]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  5. [5]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  6. [6]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  7. [7]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  8. [8]
    Trend Micro Mustang Panda Earth Preta TONESHELL June 2023

    Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.

    Open source URL
  9. [9]
    Unit42 Chinese VSCode 06 September 2024

    Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

    Open source URL
  10. [10]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  11. [11]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  12. [12]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  13. [13]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  14. [14]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  15. [15]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  16. [16]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  17. [17]
    mitre-attackS1239
    Open source URL
  18. [18]
    mitre-attackS1239
    Open source URL
  19. [19]
    mitre-attackS1239
    Open source URL
  20. [20]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  21. [21]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  22. [22]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  23. [23]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  24. [24]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  25. [25]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  26. [26]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  27. [27]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  28. [28]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  29. [29]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  30. [30]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  31. [31]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  32. [32]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  33. [33]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  34. [34]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  35. [35]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  36. [36]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  37. [37]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  38. [38]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  39. [39]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  40. [40]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  41. [41]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  42. [42]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  43. [43]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  44. [44]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  45. [45]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  46. [46]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  47. [47]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  48. [48]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  49. [49]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  50. [50]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  51. [51]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  52. [52]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  53. [53]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  54. [54]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  55. [55]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  56. [56]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  57. [57]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  58. [58]
    Trend Micro Mustang Panda Earth Preta TONESHELL June 2023

    Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.

    Open source URL
  59. [59]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  60. [60]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  61. [61]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  62. [62]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  63. [63]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  64. [64]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  65. [65]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  66. [66]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  67. [67]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  68. [68]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  69. [69]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  70. [70]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  71. [71]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  72. [72]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  73. [73]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  74. [74]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  75. [75]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  76. [76]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  77. [77]
    Trend Micro Mustang Panda Earth Preta TONESHELL June 2023

    Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.

    Open source URL
  78. [78]
    Trend Micro Mustang Panda Earth Preta TONESHELL June 2023

    Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.

    Open source URL
  79. [79]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  80. [80]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  81. [81]
    Unit42 Chinese VSCode 06 September 2024

    Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

    Open source URL
  82. [82]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  83. [83]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  84. [84]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  85. [85]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  86. [86]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  87. [87]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  88. [88]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  89. [89]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  90. [90]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  91. [91]
    ATTACKIQ MUSTANG PANDA TONESHELL March 2023

    Ken Towne, Francis Guibernau. (2023, March 23). Emulating the Politically Motivated Chinese APT Mustang Panda. Retrieved September 10, 2025.

    Open source URL
  92. [92]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  93. [93]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  94. [94]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  95. [95]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  96. [96]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  97. [97]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  98. [98]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  99. [99]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  100. [100]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  101. [101]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  102. [102]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  103. [103]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  104. [104]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  105. [105]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  106. [106]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  107. [107]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  108. [108]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  109. [109]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  110. [110]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  111. [111]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  112. [112]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  113. [113]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  114. [114]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  115. [115]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  116. [116]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  117. [117]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  118. [118]
    Unit42 Chinese VSCode 06 September 2024

    Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

    Open source URL
  119. [119]
    Unit42 Chinese VSCode 06 September 2024

    Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

    Open source URL
  120. [120]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  121. [121]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  122. [122]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  123. [123]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  124. [124]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  125. [125]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  126. [126]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  127. [127]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  128. [128]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  129. [129]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  130. [130]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  131. [131]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  132. [132]
    Unit42 Chinese VSCode 06 September 2024

    Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

    Open source URL
  133. [133]
    Unit42 Chinese VSCode 06 September 2024

    Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

    Open source URL
  134. [134]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  135. [135]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  136. [136]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  137. [137]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  138. [138]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  139. [139]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  140. [140]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  141. [141]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  142. [142]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  143. [143]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  144. [144]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  145. [145]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  146. [146]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  147. [147]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  148. [148]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  149. [149]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  150. [150]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  151. [151]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  152. [152]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  153. [153]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  154. [154]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  155. [155]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  156. [156]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  157. [157]
    2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

    Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.

    Open source URL
  158. [158]
    Trend Micro Mustang Panda Earth Preta TONESHELL June 2023

    Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.

    Open source URL
  159. [159]
    Trend Micro Mustang Panda Earth Preta Toneshell February 2025

    Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.

    Open source URL
  160. [160]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  161. [161]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  162. [162]
    CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024

    CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.

    Open source URL
  163. [163]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  164. [164]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  165. [165]
    2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

    Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.

    Open source URL
  166. [166]
    Zscaler

    Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.

    Open source URL
  167. [167]
    Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

    Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.

    Open source URL
  168. [168]
    Unit42 Chinese VSCode 06 September 2024

    Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use